Skip to content
OpenAdvisories
High ALAS2023-2025-1255 3 CVEs

Important: bind security update (Amazon Linux 2023)

Published Nov 5, 2025 · Updated Nov 5, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8677: Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. CVE-2025-40780: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. CVE-2025-40778: Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2023 bind 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-chroot 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-debuginfo 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-debugsource 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-devel 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-dnssec-utils 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-dnssec-utils-debuginfo 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-doc 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-libs 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-libs-debuginfo 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-license 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-utils 32:9.18.33-1.amzn2023.0.4
Amazon Linux · 2023 bind-utils-debuginfo 32:9.18.33-1.amzn2023.0.4

Vulnerabilities 3

  • High 8.6
    CVE-2025-40778 Public exploit

    Cache poisoning attacks with unsolicited RRs

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.6
    CVE-2025-40780

    Cache poisoning due to weak PRNG

    In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-8677 EPSS 11%

    Resource exhaustion via malformed DNSKEY handling

    Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-40778.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-40780.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-8677.html